Download the Latest Secure-Software-Design Dumps - 2025 Secure-Software-Design Exam Questions
Latest WGU Secure-Software-Design Certification Practice Test Questions
WGU Secure-Software-Design Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 65
Which software development model starts by specifying and implementing just a part of the software, which is then reviewed and identifies further requirements that are implemented by repeating the cycle?
- A. Iterative
- B. Waterfall
- C. Code and fix
- D. Implementation
Answer: A
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The Iterative software development model fits this description. It involves specifying and implementing a portion of the software, reviewing it, gathering feedback, and refining or adding requirements in successive cycles. This approach supports evolving requirements and continuous improvement. Iterative models contrast with Waterfall (C), which is linear and sequential, with no repetition of phases. "Code and fix" (D) is an informal, ad hoc process lacking formal review cycles. Implementation (B) is a phase, not a model. The iterative approach is advocated in ISO/IEC 12207 and NIST guidelines for secure development, as it allows early detection and remediation of security issues by incremental design and testing.
References:
ISO/IEC 12207 Software Lifecycle Processes
NIST SP 800-64 Revision 2: Security Considerations in SDLC
Microsoft SDL Documentation
NEW QUESTION # 66
The security team is reviewing all noncommercial software libraries used in the new product to ensure they are being used according to the legal specifications defined by the authors.
What activity of the Ship SDL phase is being performed?
- A. Penetration testing
- B. Open-source licensing review
- C. Final security review
- D. Policy compliance analysis
Answer: B
Explanation:
The activity described pertains to the review of noncommercial software libraries to ensure compliance with the legal specifications set by the authors. This is part of the open-source licensing review, which is a critical activity in the Ship phase of the Security Development Lifecycle (SDL). This review ensures that all open-source components are used in accordance with their licenses, which is essential for legal and security compliance.
References: The Ship phase of the SDL includes various activities such as policy compliance review, vulnerability scanning, penetration testing, open-source licensingreview, and final security and privacy reviews12. The open-source licensing review specifically addresses the legal aspects of using third-party software components2.
NEW QUESTION # 67
Which DKEAD category has a risk rating based on the threat exploit's potential level of harm?
- A. Exploitability
- B. Reproducibility
- C. Affected users
- D. Damage potential
Answer: D
Explanation:
The DKEAD category that has a risk rating based on the threat exploit's potential level of harm is Damage potential. This category assesses the total damage or impact that a threat could cause if it is exploited by an attacker. The risk rating in this category is determined by evaluating the severity of the potential damage, which could range from information disclosure to complete system destruction or loss of system availability.
:
DREAD Threat Modeling1
OWASP Risk Rating Methodology2
DREAD Threat Modeling: An Introduction to Qualitative Risk Analysis3
NEW QUESTION # 68
Which SDL security goal is defined as ensuring timely and reliable access to and use of information?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Information security
Answer: B
Explanation:
The term 'availability' in the context of Secure Software Development Lifecycle (SDL) refers to ensuring that systems, applications, and data are accessible to authorized userswhen needed. This means that the information must be timely and reliable, without undue delays or interruptions. Availability is a critical aspect of security, as it ensures that the software functions correctly and efficiently, providing users with the information they need to perform their tasks.
References:
* The definition of availability as per the National Institute of Standards and Technology (NIST) Glossary1.
* The Microsoft Security Development Lifecycle (SDL) which emphasizes the importance of availability in secure software design2.
* General principles of Secure Software Development Life Cycle (SSDLC) that include availability as a key security goal3.
NEW QUESTION # 69
Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer software program?
- A. Static analysis
- B. Dynamic analysis
- C. Bugtraq
- D. Fuzzing
Answer: D
Explanation:
Fuzzing is an automated or semi-automated software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program1. This process is designed to uncover coding errors, security vulnerabilities, and other potential issues within the software by observing how it behaves under unexpected or malformed inputs. Fuzzing is particularly effective because it can expose corner cases that have not been properly dealt with and can be used to test programs that take structured inputs, such as file formats or protocols2.
References: 1: Wikipedia - Fuzzing 2: DZone - Fuzzing in Software Engineering
NEW QUESTION # 70
The software security team prepared a detailed schedule napping security development lifecycle phases to the type of analysis they will execute.
Which design and development deliverable aid the team prepare?
- A. Security test plans
- B. Design security review
- C. Privacy implementation assessment results
- D. Updated threat modeling artifacts
Answer: A
Explanation:
The deliverable that would aid a software security team in preparing a detailed schedule mapping security development lifecycle phases to the type of analysis they will execute is Security test plans. These plans are crucial as they outline the testing strategies and specific security tests that will be conducted during the development lifecycle to ensure the software meets the required security standards.
* Security test plans are developed after the requirements and design phases and are used throughout the implementation, verification, and release phases. They include detailed instructions for security testing, criteria for success, and the types of security testing to be performed, such as static and dynamic analysis, penetration testing, and code review.
* These plans are living documents that should be updated as new threats are identified and as the project evolves. They ensure that all team members understand the security goals, the risks, and the measures that need to be taken to mitigate those risks.
* By having a well-defined security test plan, the team can ensure that security is not an afterthought but is integrated into every phase of the software development lifecycle, thus producing more secure software.
: The importance of security test plans in the software development lifecycle is supported by best practices and guidelines from sources such as Microsoft's Security Development Lifecycle1 and Snyk's Secure Software Development Life Cycle principles2.
NEW QUESTION # 71
Which software control test examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output?
- A. White box
- B. Dynamic
- C. Static
- D. Black box
Answer: D
Explanation:
The software control test that examines an application from a user perspective by providing a wide variety of input scenarios and inspecting the output is known as black box testing. This testing method focuses on the functionality of the application rather than its internal structures or workings. Testers provide inputs and examine outputs without knowing how and where the inputs are worked upon. It's designed to test the system' s external behavior.
* Black box testing is used to verify that the system meets the requirements and behaves as expected in various scenarios, including edge cases and incorrect input data. It helps in identifying discrepancies between the system's actual functionality and its specified requirements.
* This type of testing is applicable across various levels of software testing, including unit, integration, system, and acceptance testing. It is particularly useful for validating user stories and use cases during the software development process.
* Since black box testing treats the software as a "black box", it does not require the tester to have knowledge of the programming languages or the system's implementation. This allows testers to objectively test the software's behavior and performance.
References: The concept of black box testing is well-documented and is a standard practice in secure software design, as outlined by sources such as LambdaTest1 and other industry best practices.
NEW QUESTION # 72
After being notified of a vulnerability in the company's online payment system, the Product Security Incident Response Team (PSIRT) was unable to recreate the vulnerability in a testing lab.
What is the response team's next step?
- A. Determine the Severity of the Vulnerability
- B. Identify Resources and Schedule the Fix
- C. Notify the Reporter That the Case Is Going to Be Closed
- D. Determine How the Reporter Was Able to Create the Vulnerability
Answer: D
NEW QUESTION # 73
A product team, consisting of a Scrum Master, a Business Analyst, two Developers, and a Quality Assurance Tester, are on a video call with the Product Owner. The team is reviewing a list of work items to determine how many they feel can be added to their backlog and completed within the next two-week iteration.
Which Scrum ceremony is the team participating in?
- A. Daily Scrum
- B. Sprint Retrospective
- C. Sprint Review
- D. Sprint Planning
Answer: D
NEW QUESTION # 74
While performing functional testing of the ordering feature in the new product, a tester noticed that the order object was transmitted to the POST endpoint of the API as a human-readable JSON object.
How should existing security controls be adjusted to prevent this in the future?
- A. Ensure sensitive transactions can be traced through an audit log
- B. Ensure passwords and private information are not logged
- C. Ensure all requests and responses are encrypted
- D. Ensure the contents of authentication cookies are encrypted
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
Transmitting data in a human-readable format, such as JSON, over an API can expose sensitive information if the communication channel is not secure. To protect the confidentiality and integrity of the data, it's essential to encrypt all requests and responses between clients and servers.
Implementing encryption, typically through protocols like HTTPS (which utilizes TLS/SSL), ensures that data transmitted over the network is not readable by unauthorized parties. This prevents potential attackers from intercepting and understanding the data, thereby safeguarding sensitive information contained within the API communications.
This practice is a fundamental aspect of secure software development and aligns with the Implementation business function of the OWASP SAMM. Within this function, the Secure Build practice emphasizes the importance of configuring the software to operate securely in its intended environment, which includes enforcing encryption for data in transit.
References:
* OWASP SAMM: Implementation - Secure Build
NEW QUESTION # 75
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?
- A. Attack modeling
- B. Define objectives
- C. Risk and impact analysis
- D. Define technical scope
Answer: D
Explanation:
The step of the PASTA threat modeling methodology where the team will capture infrastructure, application, and software dependencies is the Define technical scope step. This step involves detailing the technical elements of the project, which includes understanding and documenting the infrastructure, applications, and software dependencies that are critical to the system's operation and security.
References: The PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology is a seven-step process that includes defining the technical scope as a critical step for capturing the necessary technical details of the system being analyzed123.
NEW QUESTION # 76
The security team has a library of recorded presentations that are required viewing tor all new developers in the organization. The video series details organizational security policies and demonstrates how to define, test for. and code tor possible threats.
Which category of secure software best practices does this represent?
- A. Training
- B. Attack models
- C. Architecture analysis
- D. Code review
Answer: A
Explanation:
The category of secure software best practices being described is Training. This is because the focus is on educating new developers about organizational security policies and coding practices to mitigate potential threats. Training is a proactive approach to ensure that developers are aware of security concerns and are equipped with the knowledge to address them in their coding practices.
References: The importance of training in secure software best practices is supported by industry resources such as the SAFECode's "Fundamental Practices for Secure Software Development" which emphasizes the need for application security control definition and management1, and the NIST's Secure Software Development Framework (SSDF) which recommends integrating secure development practices throughout the software development lifecycle2. Additional support for this category can be found in resources detailing effective secure development practices345.
NEW QUESTION # 77
What refers to the review of software source code by developers other than the original coders to try to identify oversights, mistakes, assumptions, a lack of knowledge, or even experience?
- A. Fault injection
- B. Dynamic code review
- C. User acceptance testing
- D. Manual peer review
Answer: D
Explanation:
Manual peer review refers to the systematic examination of software source code by developers other than the original author. This practice is recognized as a valuable tool for reducing software defects and improving the quality of software projects. It involves developers inspecting the code to find and fix mistakes overlooked in the initial development phase, which enhances both the overall quality of software and the developers' skills.
Peer code review is less formal and more "lightweight" than the code inspections performed in the past, and it provides benefits such as knowledge transfer, increased team awareness, and creation of alternative solutions to problems.
References:
* Expectations, Outcomes, and Challenges Of Modern Code Review1
* Introduction to Software Engineering/Quality/Code Review2
* Software Security during Modern Code Review: The Developer's Perspective3
NEW QUESTION # 78
What are the three primary goals of the secure software development process?
- A. Performance, reliability, and maintainability
- B. Confidentiality, integrity, and availability
- C. Redundancy, scalability, and portability
- D. Cost, speed to market, and profitability
Answer: B
Explanation:
The three primary goals of the secure software development process, often referred to as the CIA triad, are confidentiality, integrity, and availability. These principles form the cornerstone of security considerations in the software development life cycle (SDLC).
* Confidentiality ensures that sensitive information is accessed only by authorized individuals and systems. This involves implementing access controls and encryption to protect data from unauthorized access.
* Integrity refers to maintaining the accuracy and consistency of data across its lifecycle. This means that the data is not altered or tampered with by unauthorized entities. Techniques like checksums and digital signatures help ensure data integrity.
* Availability ensures that information and resources are accessible to authorized users when needed.
This involves creating resilient systems that can withstand attacks and recover quickly from any disruptions.
By integrating these security goals into each phase of the SDLC, from planning and design to development, testing, and maintenance, organizations can create more secure software systems that are resilient to cyber threats.
References: The information provided here is verified as per the Secure Software Design documents and best practices in the field, as outlined by sources such as Snyk1, GeeksforGeeks2, and SAFECode3.
NEW QUESTION # 79
Which type of security analysis is performed by injecting malformed data into open interfaces of an executable or running application and is most commonly executed during the testing or deployment phases of the SDLC?
- A. Dynamic Analysis
- B. Fuzz Testing
- C. Static Analysis
- D. Manual Code Review
Answer: B
NEW QUESTION # 80
The security software team has cloned the source code repository of the new software product so they can perform vulnerability testing by modifying or adding small snippets of code to see if they can cause unexpected behavior and application failure.
Which security testing technique is being used?
- A. Source-Code Fault Injection
- B. Dynamic Code Analysis
- C. Fuzz Testing
- D. Binary Fault Injection
Answer: A
NEW QUESTION # 81
The product security incident response team (PSIRT) has decided to make a formal public disclosure, including base and temporal common vulnerability scoring system (CVSS) scores and a common vulnerabilities and exposures (CVE) ID report, of an externally discovered vulnerability.
What is the most likely reason for making a public disclosure?
- A. The vulnerability reporter has threatened to make the finding public after being notified that their case was not credible.
- B. The potential for increased public awareness of a vulnerability is probable, which could lead to higher risk for customers.
- C. The response team has determined that the vulnerability is credible.
- D. Notification of a vulnerability from an external party has occurred.
Answer: C
NEW QUESTION # 82
What is a countermeasure to the web application security frame (ASF) data validation/parameter validation threat category?
- A. All exceptions are handled in a structured way.
- B. All administrative activities are logged and audited.
- C. Inputs enforce type, format, length, and range checks.
- D. Sensitive information is not logged.
Answer: C
NEW QUESTION # 83
In which step of the PASTA threat modeling methodology will the team capture infrastructure, application, and software dependencies?
- A. Attack modeling
- B. Define objectives
- C. Risk and impact analysis
- D. Define technical scope
Answer: D
Explanation:
The step of the PASTA threat modeling methodology where the team will capture infrastructure, application, and software dependencies is the Define technical scope step. This step involves detailing the technical elements of the project, which includes understanding and documenting the infrastructure, applications, and software dependencies that are critical to the system's operation and security.
: The PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology is a seven- step process that includes defining the technical scope as a critical step for capturing the necessary technical details of the system being analyzed123.
NEW QUESTION # 84
What sits between a browser and an internet connection and alters requests and responses in a way the developer did not intend?
- A. Intercept proxy
- B. Load testing
- C. Input validation
- D. Reverse engineering
Answer: A
Explanation:
An intercept proxy, also known as a proxy server, sits between a web client (such as a browser) and an external server to filter, monitor, or manipulate the requests and responses passing through it. This can be used for legitimate purposes, such as security testing and user privacy, but it can also be exploited by attackers to alter web traffic in a way that the developer did not intend, potentially leading to security vulnerabilities.
:
Understanding of HTTP and HTTPS protocols12.
Definition and role of proxy servers3.
NEW QUESTION # 85
Using a web-based common vulnerability scoring system (CVSS) calculator, a security response team member performed an assessment on a reported vulnerability in the user authentication component of the company's now product. The base score of the vulnerability was 8.3 and changed to 9.4 after adjusting temporal and environmental metrics.
Which rating would CVSS assign this vulnerability?
- A. Medium severity
- B. Low seventy
- C. High seventy
- D. Critical severity
Answer: D
Explanation:
The task described involves assessing a document management application that has been in use for many years to ensure compliance with organizational policies. This typically falls under the category of a security strategy for legacy code. Legacy code refers to software that has been around for a while and may not have been designed with current security standards or organizational policies in mind. A security strategy for legacy code would involve reviewing and updating the application to meet current security requirements and organizational policies, ensuring that it remains secure and compliant over time.
References: The answer is based on standard practices for managing and securing legacy software systems, which include regular assessments and updates to align with current security standards and organizational policies1.
NEW QUESTION # 86
The software security group is conducting a maturity assessment using the Building Security in Maturity Model (BSIMM). They are currently focused on reviewing attack models created during recently completed initiatives.
Which BSIMM domain is being assessed?
- A. Deployment
- B. Intelligence
- C. Governance
- D. Software security development life cycle (SSDL) touchpoints
Answer: B
Explanation:
The Intelligence domain in the Building Security in Maturity Model (BSIMM) focuses on gathering and using information about software security. This includes understanding the types of attacks that are possible against the software being developed, which is why reviewing attack models falls under this domain. The BSIMM domain of Intelligence involves creating models of potential attacks on software (attack models), analyzing actual attacks that have occurred (attack intelligence), and sharing this information to improve security measures. By reviewing attack models, the software security group is essentially assessing the organization's ability to anticipate and understand potential security threats, which is a key aspect of the Intelligence domain.
References: The references used to verify this answer include the official BSIMM documentation and related resources that describe the various domains and their activities within the BSIMM framework12345.
NEW QUESTION # 87
Which mitigation technique can be used to light against a threat where a user may gain access to administrator level functionality?
- A. Quality of service
- B. Run with least privilege
- C. Hashes
- D. Encryption
Answer: B
Explanation:
The principle of running with the least privilege is a fundamental security concept that involves granting users only the permissions they need to perform their tasks and no more. This minimizes the risk of a user gaining access to administrator-level functionality that they are not authorized to use. By limiting the privileges of user accounts to the bare minimum necessary, the potential damage from various attacks, such as privilege escalation, is significantly reduced.
References: The concept of least privilege is widely recognized as a critical security measure. Resources like Exabeam's article on preventing privilege escalation and TechTarget's guide on privilege escalation attacks provide insights into how enforcing least privilege can mitigate such threats12. These sources verify that running with the least privilege is an effective mitigation technique against the threat of unauthorized access to elevated privileges.
NEW QUESTION # 88
Which threat modeling step collects exploitable weaknesses within the product?
- A. Rate threats
- B. Identify and document threats
- C. Analyze the target
- D. Set the scope
Answer: B
Explanation:
The step in threat modeling that involves collecting exploitable weaknesses within the product is Identify and document threats. This step is crucial as it directly addresses the identification of potential security issues that could be exploited. It involves a detailed examination of the system to uncover vulnerabilities that could be targeted by threats.
References: The OWASP Foundation's Threat Modeling Process outlines a structured approach where identifying and documenting threats is a key step1. Additionally, various sources on threat modeling agree that the identification of threats is a fundamental aspect of the process, as it allows for the subsequent analysis and mitigation of these threats2345.
NEW QUESTION # 89
......
Verified Secure-Software-Design Dumps Q&As - 1 Year Free & Quickly Updates: https://actualtests.crampdf.com/Secure-Software-Design-exam-prep-dumps.html